CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8616
https://notcve.org/view.php?id=CVE-2015-8616
Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array. Vulnerabilidad de uso después de liberación de memoria en la función Collator::sortWithSortKeys en ext/intl/collator/collator_sort.c en PHP 7.x en versiones anteriores a 7.0.1 permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente tener otro impacto no especificado mediante el aprovechamiento de la relación entre un buffer de claves y un array destruido. • http://php.net/ChangeLog-7.php https://bugs.php.net/bug.php?id=71020 •
CVSS: 10.0EPSS: 17%CPEs: 1EXPL: 2CVE-2015-8617 – PHP 7.0.0 - Format String
https://notcve.org/view.php?id=CVE-2015-8617
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling. Vulnerabilidad de formato de cadena en la función zend_throw_or_error en Zend/zend_execute_API.c en PHP 7.x en versiones anteriores a 7.0.1 permite a atacantes remotos ejecutar código arbitrario a través de especificadores de formato de cadena en una cadena que se utiliza de forma incorrecta como nombre de una clase, conduciendo al manejo de errores incorrecto. • https://www.exploit-db.com/exploits/39082 http://php.net/ChangeLog-7.php http://www.securitytracker.com/id/1034543 https://bugs.php.net/bug.php?id=71105 https://github.com/php/php-src/commit/b101a6bbd4f2181c360bd38e7683df4a03cba83e • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 1CVE-2015-6527
https://notcve.org/view.php?id=CVE-2015-6527
The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function. La función php_str_replace_in_subjec en ext/standard/string.c en PHP 7.x en versiones anteriores a 7.0.0 permite a atacantes remotos ejecutar código arbitrario a través de un valor manipulado en el tercer argumento en la función str_ireplace. • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=6aeee47b2cd47915ccfa3b41433a3f57aea24dd5 http://www.openwall.com/lists/oss-security/2015/07/30/11 https://bugs.php.net/bug.php?id=70140 •
CVSS: 9.1EPSS: 8%CPEs: 28EXPL: 1CVE-2016-1903 – php: Out-of-bounds memory read via gdImageRotateInterpolated
https://notcve.org/view.php?id=CVE-2016-1903
The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function. La función gdImageRotateInterpolated en ext/gd/libgd/gd_interpolation.c en PHP en versiones anteriores a 5.5.31, 5.6.x en versiones anteriores a 5.6.17 y 7.x en versiones anteriores a 7.0.2 permite a atacantes remotos obtener información sensible o causar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de un argumento bgd_color de gran tamaño para la función imagerotate. A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted image file could cause a PHP application using the imagerotate() function to disclose portions of the server memory or crash the PHP application. • http://lists.opensuse.org/opensuse-updates/2016-01/msg00099.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00037.html http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.openwall.com/lists/oss-security/2016/01/14/8 http://www.php.net/ChangeLog-5.php http://www.php.net/ChangeLog-7.php http://www.securityfocus.com/bid/79916 http://www.securitytracker.com/id/1034608 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 1CVE-2016-1283 – pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)
https://notcve.org/view.php?id=CVE-2016-1283
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(? • http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178193.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178955.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/79825 http://www.securitytracker.com/id/1034555 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.343110 https://access.redhat.com/errata/RHSA-2016:1132 https://bto.bluecoat.com/security-ad • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •